Harden publish workflow recovery, notifications, and dispatch guard

[glenn-jocher]

🛠️ Summary

Ports the release-workflow hardening from ultralytics/template#91 (and matching PRs in mkdocs/ultralytics). The publish.yml pipeline previously had no recovery path after a partial failure, and Slack could report success before the pipeline finished.

1. Failed releases can now be recovered via workflow_dispatch

Once the tag is pushed, any downstream failure (build, PyPI upload, SBOM) previously left the release unrecoverable — a re-run hit git tag -a on the existing tag and the check job died. Now, when the pypi dispatch input is checked, the run proceeds as a recovery re-run:

• workflow_dispatch with pypi: true forces increment=True
• Tagging is skipped when the tag already exists on origin (git ls-remote)
• Release summarization is gated independently on release existence (gh release view), healing the tag-pushed-but-no-release state, and unshallows history first so the changelog resolves the true previous tag
• previous_tag output is omitted on recovery re-runs (online == local) so the summarizer falls back to the real previous tag instead of comparing vX...vX
• PyPI upload uses skip-existing: true; SBOM upload uses --clobber

A partially failed release can be re-run from any point and completes only what is missing.

2. Slack success can no longer fire prematurely

notify now includes sbom in needs and in the success/failure conditions, so the ✅ message reflects the entire pipeline rather than racing the SBOM job.

3. workflow_dispatch can no longer release a non-main commit

The check job now requires github.ref == 'refs/heads/main'.

🧪 Testing

• YAML validated
• Same change reviewed through multiple adversarial Codex review rounds (to LGTM) on Add publish.yml release workflow template#91, mkdocs, and ultralytics; the no-failure happy path is behavior-identical to the current workflow.

🛠️ PR Summary

_{Made with ❤️ by Ultralytics Actions}

🌟 Summary

Improves the release workflow for ultralytics/actions to make publishing, tagging, SBOM uploads, and notifications more reliable and recovery-friendly 🚀

📊 Key Changes

• Restricts automated release checks to the main branch only, reducing accidental publishes 🔒
• Adds support for manual PyPI dispatch recovery runs when publishing needs to be retried 🛠️
• Prevents duplicate Git tags and GitHub releases by checking whether they already exist before creating them ✅
• Allows PyPI publishing to skip already-existing files, making partial failure recovery safer 📦
• Updates SBOM upload to use --clobber, allowing replacement of existing SBOM files ♻️
• Makes Slack success notifications depend on both PyPI publishing and SBOM generation succeeding 📣
• Updates failure notifications to trigger if either publishing or SBOM generation fails 🚨

🎯 Purpose & Impact

• Makes release automation more robust against interrupted or partially failed runs ⚙️
• Reduces manual cleanup by safely handling existing tags, releases, PyPI artifacts, and SBOM files 🙌
• Improves release accuracy by ensuring notifications reflect the full release status, not just PyPI publishing 📊
• Helps maintainers recover from release issues faster while minimizing duplicate assets or inconsistent release states 🔁

[UltralyticsAssistant]

👋 Hello @glenn-jocher, thank you for submitting a ultralytics/actions 🚀 PR! This automated message is here to help with the review process, and an Ultralytics engineer will assist as needed. Since this PR hardens the publish workflow recovery, notifications, and dispatch guard, please review the checklist below for a smooth integration:

• ✅ Define a Purpose: Clearly explain the purpose of your fix or feature in your PR description, and link to any relevant issues. Ensure your commit messages are clear, concise, and adhere to the project's conventions.
• ✅ Synchronize with Source: Confirm your PR is synchronized with the ultralytics/actions main branch. If it's behind, update it by clicking the 'Update branch' button or by running git pull and git merge main locally.
• ✅ Ensure CI Checks Pass: Verify all Ultralytics Continuous Integration (CI) checks are passing. If any checks fail, please address the issues.
• ✅ Update Documentation: Update the relevant documentation for any new or modified features.
• ✅ Add Tests: If applicable, include or update tests to cover your changes, and confirm that all tests are passing.
• ✅ Sign the CLA: Please ensure you have signed our Contributor License Agreement if this is your first Ultralytics PR by writing "I have read the CLA Document and I sign the CLA" in a new message.
• ✅ Minimize Changes: Limit your changes to the minimum necessary for your bug fix or feature addition. "It is not daily increase but daily decrease, hack away the unessential. The closer to the source, the less wastage there is." — Bruce Lee

For more guidance, please refer to our Contributing Guide. Don't hesitate to leave a comment if you have any questions. Thank you for contributing to Ultralytics! 🚀

[UltralyticsAssistant]

🔍 PR Review

_{Made with ❤️ by Ultralytics Actions}

No genuine issues found. The workflow changes are coherent: the dispatch guard is tightened, recovery reruns are handled more safely, publishing and SBOM upload are made idempotent, and notification dependencies now reflect both publish and SBOM outcomes.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[UltralyticsAssistant]

🚀 Merged — thank you @glenn-jocher for strengthening the ultralytics/actions release workflow!

“Success is not final, failure is not fatal: it is the courage to continue that counts.” — Winston Churchill

This update embodies that mindset by making publishing, tagging, SBOM uploads, and notifications more resilient and recovery-friendly. The added safeguards against duplicate releases, safer PyPI retries, improved SBOM handling, and more accurate Slack notifications will help maintainers recover faster from partial failures while keeping releases clean and reliable.

Appreciate the thoughtful improvements that make Ultralytics automation more robust for everyone 🙌